WindowsUpdate[.]zip

General

Target
WindowsUpdate.zip
Size 606KB
Sample260930-fwrdksfd82
SHA256 1565e6491c5c6201ceaa4456fd925e70dadd4980a0517d57da399707d005faef
MD5 38bce0af3296bc5a60ebfa9624c8881e
SHA1 ce3736a2ba25fb9f7abdb2771c9c7e34dc965d25
SHA512 e5b9c43f59e2edaaebb2c74338d343367a51de5572cdc8ac1171becec3f7b68f78e294fa70f2171aab1a7d2a45c4c5ae721430dbfe5374d3bba28a46e758d2f6
SSDEEP 12288:79th9uNmJwjB9XJK7+bThEBKdc5QxWQ+Tqgug5fDBuLQ/JoDrZkRAZYGt8:799OrLgGT2Qxb6qZg5rBuM/C7ZYo8
TLSH
T129D423C8BF538D809DB407F9594D4CDF2F998C782903C39E356576C824EA58C3A9EE46
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/WindowsUpdate.exe

File Explorer

WindowsUpdate.zip

.zip 606KB
WindowsUpdate.exe

.exe 760KB

WindowsUpdate.zip

SHA256 1565e6491c5c6201ceaa4456fd925e70dadd4980a0517d57da399707d005faef
MD5 38bce0af3296bc5a60ebfa9624c8881e
SHA1 ce3736a2ba25fb9f7abdb2771c9c7e34dc965d25
SHA512 e5b9c43f59e2edaaebb2c74338d343367a51de5572cdc8ac1171becec3f7b68f78e294fa70f2171aab1a7d2a45c4c5ae721430dbfe5374d3bba28a46e758d2f6
SSDEEP 12288:79th9uNmJwjB9XJK7+bThEBKdc5QxWQ+Tqgug5fDBuLQ/JoDrZkRAZYGt8:799OrLgGT2Qxb6qZg5rBuM/C7ZYo8
TLSH
T129D423C8BF538D809DB407F9594D4CDF2F998C782903C39E356576C824EA58C3A9EE46
MD5 SHA1 SHA512 SSDEEP TLSH

WindowsUpdate.exe

IMPHASH 0dc8590769efaccd25273172540c1f5c
SHA256 0fda176b199295f72fafc3bc25cefa27fa44ed7712c3a24ca2409217e430436d
MD5 515198a8dfa7825f746d5921a4bc4db9
SHA1 e1da0b7f046886c1c4ff6993f7f98ee9a1bc90ae
SHA512 9e47037fe40b79ebf056a9c6279e318d85da9cd7e633230129d77a1b8637ecbafc60be38dd21ca9077ebfcb9260d87ff7fcc85b8699b3135148fe956972de3e8
SSDEEP 12288:7Lthbs5mJybBx5PK7+PTjslKd+FKxkQ+5qgIU5fZf+FQ/JSD39WRkZYZ6fLr:fbgvFCGTKKxNiqtU5Rf+W/kPZYwzr
TLSH
T125F422CC7781894CDB7CC374191DC9791B9D9C75ED8B82EAFB8936C82C7628C3616A12
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

2691931

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

WindowsUpdate.zip

WindowsUpdate.exe

kernel32

winspool.drv

comctl32

shell32

user32

version

oleaut32

advapi32

netapi32

msvcrt

ole32

gdi32

generic

Sharing

General

Malware Config

Signatures

File Explorer

WindowsUpdate.zip

WindowsUpdate.exe

kernel32

winspool.drv

comctl32

shell32

user32

version

oleaut32

advapi32

netapi32

msvcrt

ole32

gdi32

generic